From fe4cf472b6b0d53a23118b9a3ea60b414dd61951 Mon Sep 17 00:00:00 2001 From: Neil McGovern Date: Tue, 24 Jan 2006 09:25:23 +0000 Subject: Releasing DTSA-27-1 : fuse git-svn-id: svn+ssh://svn.debian.org/svn/secure-testing@3356 e39458fd-73e7-0310-bf30-c45bca0a0e42 --- website/DTSA/DTSA-27-1.html | 96 +++++++++++++++++++++++++++++++++++++++++++++ website/list.html | 2 + 2 files changed, 98 insertions(+) create mode 100644 website/DTSA/DTSA-27-1.html (limited to 'website') diff --git a/website/DTSA/DTSA-27-1.html b/website/DTSA/DTSA-27-1.html new file mode 100644 index 0000000000..e6b407e74f --- /dev/null +++ b/website/DTSA/DTSA-27-1.html @@ -0,0 +1,96 @@ + + + Debian testing security team - Advisory + + + + +
+ + + + + Debian Project +
+
+ + + + + + + + + + + +
+ Debian testing security team - Advisory +
+ + +
+ + +

DTSA-27-1

+
+
Date Reported:
+
Janurary 20th, 2006
+
Affected Package:
+
fuse
+
Vulnerability:
+
potential data corruption when installed seduid root
+
Problem-Scope:
+
local
+
Debian-specific:
+
No
+
CVE:
+
+CVE-2005-3531 +
+
More information:
+
Thomas Biege discovered that fusermount in FUSE before 2.4.1, if installed 
+setuid root, allows local users to corrupt /etc/mtab and possibly modify mount 
+options by performing a mount over a directory whose name contains certain 
+special characters 
+ 
+Successful exploitation could result in a denial of service if mount options 
+become unusable. An attacker can also exploit this issue to add arbitrary mount 
+points that could grant the attacker read and possibly write access to 
+otherwise restricted or privileged mount points. Other attacks are also 
+possible. 
+
+
For the testing distribution (etch) this is fixed in version 2.3.0-4.2etch1
+
For the unstable distribution (sid) this is fixed in version 2.4.1-0.1
+
This upgrade is recommended if you use fuse.
+
If you have the secure testing lines in your sources.list, you can update by running this command as root:
+ +
apt-get update && apt-get upgrade
+
+ +
+
To use the Debian testing security archive, add the following lines to your /etc/apt/sources.list:
+
+
deb http://secure-testing-mirrors.debian.net/debian-secure-testing etch-proposed-updates/security-updates main contrib non-free
+
deb-src http://secure-testing-mirrors.debian.net/debian-secure-testing etch-proposed-updates/security-updates main contrib non-free
+
+
The archive signing key can be downloaded from
+
http://secure-testing.debian.net/ziyi-2005-7.asc
+ +
+ + +
+ + Valid HTML 4.01! + + Valid CSS! + + + + diff --git a/website/list.html b/website/list.html index 8c97d4b44a..61b2f10754 100644 --- a/website/list.html +++ b/website/list.html @@ -87,6 +87,8 @@
access validation error
[December 5th, 2005] DTSA-26-1 trackballs
symlink attack
+
[Janurary 20th, 2006] DTSA-27-1 fuse
+
potential data corruption when installed seduid root
-- cgit v1.2.3